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Overview 

On April 8, 2011, the U.S. Department of Education (USED) published in the Federal Register new proposed amendments 
to regulations implementing the Family Educational Rights and Privacy Act (FERPA). The notice invites public comments 
on the proposed regulations, which are due no later than May 23, 2011. Following its review of comments received, 
USED will issue the regulations in final form, with possible revisions that it deems appropriate based on its review of the 
public comments. The regulations will be legally effective and binding only after they are issued in final form. 

FERPA protects the privacy of student education records maintained by or for educational agencies or institutions that 
receive funds from USED. FERPA generally bars disclosure of personally identifiable information derived from student 
records without written parent or eligible student consent unless the disclosure comes within a list of authorized 
disclosures in the law. With the emergence of state data systems and the recognition that robust use of student data is 
needed as a foundation for education reform, difficult issues have arisen as to how to reconcile or balance privacy 
protections for students under FERPA with these educational needs. Past interpretations of FERPA by USED have chilled 
or raised confusion among state and local educators in developing state data systems consistent with state and local 
needs and with federal mandates. In regulations issued under the American Recovery and Reinvestment Act of 2009 
(ARRA), USED indicated that it would be issuing amended FERPA regulations to address these issues. 

The proposed regulations are designed to facilitate fuller access for research and evaluation purposes to student data 
contained in state longitudinal data systems (SLDSs) in order to increase accountability and transparency for educational 
outcomes and to contribute to a culture of innovation and continuous improvement in education, while at the same time 
enhancing privacy protections through expanded requirements for written agreements as the basis for disclosures of 
data and USED enforcement mechanisms. They would authorize fuller, more cost effective use of state-level student 
data for research, evaluation, and accountability, subject to clear privacy protections, as well as effective use of data 
across all levels of education to evaluate and improve education programs. As stated in the notice, the proposed 
regulations reflect a review by USED of the possible impact of current FERPA regulations on the level of state-level 
student data sharing contemplated under the ARRA and other federal legislation. 

Key Areas of Proposed Change 

State and local data systems. The proposed regulations would broaden access to data 1 by: 

• Broadening the categories of individuals/entities that may receive data for evaluation/audit purposes. Subject 
to privacy safeguards discussed below, the proposed regulations would permit state or local education officials 
to disclose data to any entity or person designated by the state or local educational authority for the purpose of 
evaluating or auditing federal or state-supported education programs, or enforcing compliance with federal legal 
requirements relating to those programs. Thus, a state or local education official could disclose data to a 
workforce agency or other non-education agency for these purposes. This proposed change would also permit 
education data to be housed in a centralized state data agency that is not an education agency. (The proposed 
rule would not permit disclosure of data to a non-education agency for its own purposes— for example, to 
evaluate or strengthen non-education programs or services.) 

• Authorizing disclosures from postsecondary institutions to K-12 officials/data systems for the purposes of 
evaluating/auditing K-12 programs. The proposed regulations reverse USED's prior interpretation that data 
could be disclosed only to evaluate or audit programs of the disclosing agency. That previous interpretation 
barred postsecondary institutions from disclosing data to local educational agencies if the purpose was to use 


1 References in this summary analysis to "data" and to "disclosures" refer to personally identifiable information and disclosures of personally 
identifiable information derived from student education records without the written consent of a parent or eligible student. 
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the data to evaluate how well the K-12 system or secondary schools had prepared students for college. It had a 
parallel effect on the disclosure of data by elementary schools to early childhood programs. USED expressly 
proposes to revoke the prior interpretation. 

• Broadly defining education programs under the law's evaluation/audit provisions. The proposed regulations 
broadly define an "education program" that may be the subject of an evaluation or audit to include education 
programs administered by agencies or entities that are not state educational agencies or local educational 
agencies. The proposed definition includes any program that is principally engaged in the provision of education 
and includes, among other programs, early childhood education, career and technical education, and job 
training programs. 

• Authorizing state or local agency disclosures for research studies. The proposed regulations provide that nothing 
in FERPA prevents a state or local education authority from [1] entering into agreements with organizations 
conducting research studies (for example, to improve instruction) and [2] re-disclosing data to such 
organizations on behalf of educational agencies or institutions (subject to the same kind of agreement to protect 
privacy that already applies to educational agencies or institutions). This provision would, for the first time, 
make the research studies provision in FERPA applicable to state-level data. The preamble to the proposed 
regulations recognizes that state educational agencies and state higher education agencies typically have either 
express or implied authority to perform and support research and evaluation of publicly funded education 
programs for the benefit of multiple educational agencies and institutions in their state. 

New Privacy Safeguards. The proposed regulations would balance the provisions for expanded access, described above, 
with new provisions to protect the privacy of student records, including: 

• Reasonable methods to ensure compliance. The proposed regulations vest responsibility in the state or local 
education authority to use "reasonable methods" to ensure that any entity designated as its authorized 
representative to receive data to conduct evaluations, audits, or compliance activities complies with FERPA. The 
proposed regulations do not define "reasonable methods," but expressly solicit public comment on what would 
constitute reasonable methods. 

• Written agreements with authorized representatives. The proposed regulations require written agreements 
that address privacy safeguards between the state or local education authority and its authorized representative 
to which it provides data to carry out evaluations, audits or compliance activities. The agreements, among other 
things, would have to specify the information to be disclosed; the authorized purpose of the disclosure; return 
or destruction of the data when no longer needed for the authorized purpose (and the time period for such 
return or destruction); and policies and procedures ensuring the protection of data from further disclosure and 
unauthorized use. 

• Debarring access for violations . The proposed regulations provide that if an authorized representative that 
receives data to perform evaluations, audits, or compliance activities improperly discloses the data in violation 
of FERPA, the educational authority that provided the data would be required to deny that representative 
further access to personally identifiable data for at least five years. 

• Expanded jurisdiction for investigations and enforcement. The proposed regulations provide that state 
education authorities and other recipients of funds from USED - not just educational agencies and institutions 
that enroll students -- are subject to investigations and enforcement, including possible withholding of funds, for 
FERPA violations. 

Other proposed provisions: The proposed regulations include other provisions, all regarding directory information 2 : 

• Student ID numbers as directory information. The proposed regulations clarify that an educational agency or 


2 "Directory information" is personally identifiable information in a student's education record - such as a student's name, address, dates of 
attendance, major field of study, etc. - that would not generally be considered harmful or an invasion of privacy if disclosed. An educational 
agency or institution may adopt a policy to disclose all or some categories of directory information without written parent (or eligible student) 
consent and provide annual notice to parents or eligible students of that policy. A parent or eligible student has an opt out right to require that 
directory information relating to the student not be disclosed without prior written consent. 
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institution, subject to restrictions, may designate as disclosable directory information a student ID number or 
other unique personal identifier (other than a student's social security number) displayed on a student ID card or 
badge. 

• No opt out for student IDs/badges. Based on school security and safety concerns, the proposed regulations 
provide that parents (or eligible students) may not use their right to opt out of directory information disclosures 
to prevent an educational agency or institution from requiring students to wear or otherwise disclose student ID 
cards or badges when the student is on school property or engaged in school events. 

• Limited recipients/purposes for directory information disclosures. The proposed regulations clarify that an 
educational agency or institution may adopt a directory information policy limited to disclosure to specific 
parties, for specific purposes, or both - and not just a directory information policy for disclosure of directory 
information to the public - if it specifies those limits in the annual public notice it provides to parents and 
eligible students. The proposed rule would not impose record-keeping requirements for these disclosures or 
regulate re-disclosure by third parties that receive the directory information. 
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If you have questions about FERPA or about the proposed regulations, please contact EducationCounsel, LLC: 
Steve Winnick at steve.winnick@educationcounsel.com or (202) 545-2913; 

Art Coleman at arthur.coleman@educationcounsel.com or (202) 245-2912; 

Scott Palmer at scott.palmer@educationcounsel.com or (202)545-2916; 

Kate Lipper at kate.lipper@educationcounsel.com or (202) 545-2905. 
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